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In a recent paper [S. Bagherinezhad and V. Karimipour, Phys. Rev. A 67, 044302 (2003)], a 
quantum secret sharing protocol based on reusable GHZ states was proposed. However, in this 
comment, it is shown that this protocol is insecure because a cheater can gain all the secret bits 
before sharing, while introducing one data bit error at most in the whole communication, which 
makes the cheater avoid the detection by the communication parities. 

PACS numbers: 03.67.Dd, 03.65.Ud 



In a recent paper |l|, Bagherinezhad and Karimipour 
proposed a quantum secret sharing protocol based on 
reusable GHZ states as secure carriers (BK protocol). 
The security against both intercept-resend strategy and 
entangle-ancilla strategy was proved. Gao, Guo, Wen 
and Zhu showed that Eve can obtain the data bits in 
the odd rounds without being detected by the commu- 
nication parties 0. To avoid this attack, the legitimate 
parties need to interspace by stray random bits in the 
odd rounds 0. However, we will show that a cheater, 
called Bob, can gain all the secret bits before sharing at 
the cost of one data bit error at most. Bob employs a 
special attack strategy called entanglement split in one 
even round, and intercept-resends the data bits with the 
split entanglement in the sequel. 

Let us give a brief description of the BK protocol 
lj. In the odd round, Alice, Bob and Charlie share 
the carriers |G) afcc = (l/\/2)(|000) + | lll>) afoc . Alice en- 
tangles the state \qq) 12 that denotes the data bit q to 
\G) a bc by performing two CNOT gates C a iC a2 to produce 
the state \<S>° dd ) = (l/V2)(|000) a6c | OT )i 2 + |lll> a6c ]l + 
q, 1 + 9)12) (CNOT is specified by two subscripts, the 
first one is the control bit, the second is the target 
bit.). In the even round, three parties share the carri- 
ers \E) abc = (1/2)(|000) + |110) + |101) + |011» a6c . Alice 
entangles the state \q) 12 = (l/\/2)(j0, q) + |1,1 + q))u 
that denotes the data bit q to \E) a b c by performing one 
single CNOT gate C al to produce the state \^ even ) = 
(l/V2)(|0) o |0) 6c |g) 12 + |l) a |T) 6c |TTg) 12 ). Then Alice 
transmits qubits 1,2 to Bob and Charlie respectively. At 
the destination, Bob performs one single CNOT gate Cti 
and measures the qubit 1 to obtain the sending bit, and 
Charlie performs CNOT gate C c2 and measures the qubit 
2. At the end of every round, Alice, Bob and Charlie act 
the local operations of Hadamard gates on their carries 
respectively to transform \G) and \E) into each other, 
namely the appropriate one for the next round. Eve's 
presence can be detected by publicly comparing a subse- 
quence of bits sent by Alice with those received by Bob 



and Charlie after the data bits are measured. 

For convenience, we use the same notations as in 
Ref.0. 

In the beginning, corresponding to the data bits 
9i> 32) 33 j •••) <Zn that Alice wants to distribute to 
Bob and Charlie, Bob prepares two variable strings 
d±, c#2> <^3j •••! dn an d ei, e 2 , e^, e n , which are used to 
record the eavesdropping bits and the announcing bits 
respectively. For convenience, let the cheat start the sec- 
ond round. 

The whole cheat strategy consists of splitting entan- 
glement, maintaining the split entanglement, resending 
bit, and intercepting bit. 

l.The operation of splitting entanglement 

The entanglement split occurs in the second round. 
Bob intercepts the sending qubit 2, performs a unitary 
operation U on particles b, 1 and 2, and discards parti- 
cle 2, where E/|000) = |000), C7|001) = 1 110) , [7|010) = 
I 111) , U\0ll) = |001), f7|10Q) = 1 100), E7]101) = |010), 
J7|110) = |011), and £7|111) = 1 101) . The analysis is as 
following. 

Alice encodes her one bit into qubits 1,2 to produce 
the state 

Kbcu) = ^(100000) + 100011) + |01100> + 101111) 
+ 110101) + 110110) + 111001) + 111010)) (q 2 = 0), 
or \Kbci2) = -^=(100001) + 100010) + |01101> + |01110) 

+ 110100) + 110111) + |11000) + 111011)) (q 2 = l).(l) 

Here we use superscripts and 1 to denote the states 
corresponding to q 2 = and q 2 = 1, respectively. This 
notation also applies to the following equations and we 
will, for simplicity, suppress the word "or" later. 

After Bob performing the unitary operation U on par- 



2 



tides b, 1 and 2, the state will be converted into 
1 



namely 
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The entanglement split occurs. The pair of qubit a and 
qubit 1 is the EPR pair between Alice and Bob. The pair 
of qubit b and qubit c is the EPR pair between Bob and 
Charlie. The carriers become two EPR pairs instead of 
the initial GHZ state. 

This qubit 1 in the second round is one part of the 
carries in the sequel, but the qubit 1 in another round 
will be measured by Bob. For distinction, we regards this 
qubit 1 as qubit 6, which is always in Bob's site in the 
sequel. 

2. The operation of maintaining the split entanglement 
In every round, after an encoding operation and the 
corresponding decoding operation are finished by Alice 
and Bob, or by Bob and Charlie, the carries of two EPR 
states will be restored. The analysis is in the operation 
of resending bit and the operation of intercepting bit. 

According to the BK protocol in Ref.0, Alice and 
Charlie perform two Hardamard gates on their qubits a 
and c respectively at the end of every round. To maintain 
the split entanglement, Bob performs the same actions on 
qubits b and b respectively. We write the evolvement by 
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|11)) 5® (1/V2)(|00) - |H))bc in every odd round but 
(1/ V2)(|01) + 110))^® (1/V2) (|01) + 1 10)) bc in every even 
round. 

3. The operation of resending bit 

From the analysis above, In every round, Bob 
and Charlie share one of three kinds of EPR car- 
ries: (1/V2)(|00) + |ll)) bc , (l/v / 2)(|00> - |ll)) 6c , and 
(1/V2)(|01) + |10»6c. 

To resend a bit ip, Bob prepares one counterfeit particle 
in the state \ifj) as qubit 2. Bob entangles the state I?/') 2 
to the carriers by performing one CNOT gate Cb2 on 



(1/V2)(|00) + |ll))ai ® (1/V2)(|00) + |ll)) hc 
®(1/V2)(|0) + |1)) 2 , 

(l/\/2)(|01) + |10))«i ® (1/V2)(|01) + |10)) fcc 

®(1/n/2)(|0) + |1)) 2 .(3) 



(l/V2)(|00) + |ll»fe#> 2 , 
(1/V2)(|00) - |ll))6c|V>a, 
(l/V2)(|01) + |lQ)) 6o |V>a 



(5) 



to produce the state 



(l/V2)(|0,0,^ + |l,l,l + V»6c2, 

(l/V2)(|0,0,V)-|l,l,l + ^))f,c2, 
(l/V2)(|0,l» + |l,0,l + V))fcc 2 . 



(6) 



Then Bob transmits the counterfeit qubit to Charlie. 

At the destination, according to the BK protocol in 
Ref. , Charlie acts on this state by the operator C C 2 to 
produce the state 



(l/V2)(|00) + |ll)) bc |V) 2 , 

(l/V2)(|00>-|U»hM2. 
(l/v / 2)(|01) + |10)) 6c |l + V) 2 . 
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|H»6c 

" |H»6c 
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As a result, if (72 = the carriers will be 
(l/\/2)(|00) + |ll» o5 ® (1/V2)(|00) + |ll)) fcc in every 
round, whereas if qi = 1 the carriers will be (l/\/2)(|00)- 



Charlie measures the counterfeit particle to extract the 
transmission bit. The bit sent by Bob and that received 
by Charlie are same when Bob and Charlie share the 
carriers (l/v / 2)(|00)±|ll))f )c , but inverse when they share 
(1/V2)(|01) + |10)) 6c . 

In the second round, after the operation of splitting 
entanglement, Bob discards qubit 2, then records e 2 = 0, 
d,2 = and "0 = 0. Bob resends the bit i/j to Charlie. At 
the destination, Charlie receives the bit when g 2 = 0, 
but the bit 1 when (72 = 1- 

4. The operation of intercepting bit and the analysis of 
the cheat strategy 

Firstly, consider the intercept-resend in every odd 
round (round 2m + 1, 3 < 2m +1 < n). 

According to the BK protocol in Ref. 1], after Alice's 
operations C a \C a 2i the whole state will be converted into 

(l/^)(|00) a¥ |g, g )i, 2 + |11)J1 + q, 1 + q) h2 ) 
®(1/V2)(|0Q) + 111))* (ga = 0), 
(l/V2)(|00) oS |g, <?>i,2 - |ll) oF |l + q, 1 + 9)1,2) 

®(l/V2)(|00)-|ll»6c(© = l). (8) 



After receiving qubit 1 and intercepting qubit 2, Bob 
performs CNOT gates C^ 1 C^ 2 on qubits b, 1 and 2 to 



3 



produce the state 

^=(100) + \q,q)i,2 ® ^=(|00) + 111))* (q 2 = 0), 

4|(|oo) - |n)U® k,g)i )2 ® ^=(|oo) - |ii)) bc ( g2 = l). 

Then he measures qubits 1,2 in the basis {|00), 1 01) , |10), 
1 11)}. He gains the measurement outcome \q,q) 12 that 
denotes bit q. The bit sent by Alice and that received by 
Bob are always same. 

Bob records d 2m +i = q, &2m+l = q, and ip = q. By 
the operation of resending bit, Bob sends bit ip to Char- 
lie with the help of the carriers (l/\/2)(|00) + |11))& C or 
(1/V2)(|00) - |ll)) 6c . 

From the above analysis, we can see that be- 
cause Alice, Bob, and Charlie share the carriers 
(1/V2)(|00) + |11)U® (l/v/2)(|00) + |ll)) 6c or the car- 
riers (1/72)000) - |11)) 0? ® (1/V2)(|00) - |ll)) 6c , they 
possess the same bits, which makes Bob avoid detection. 

Secondly, consider the intercept-resend in every even 
round (round 2m, 4 < 2m < n). 

According to the BK protocol in Ref. lj, after Alice's 
operation C a \, the whole state will be converted into 

(l/A/2)(|00> a¥ |g>i,a + |H) a¥ |T+g)i, 2 ) ® 

(1/V2)(]00> + |ll»6c («2 =0), 

(i/V2)(|oi) aE |g) li2 + |io) a¥ |TT^)i l2 ) ® 

(l/>/2)(|01) + |10)) bc (92 = 1) (10) 

After receiving qubit 1 and intercepting qubit 2, Bob 
performs one single CNOT gate Cr l on qubits b and 1 to 
produce the state 

(l/V5)(|00) + |ll)) 87 ®|g)i, a 
«8>(1/V2)(|00) + |ll)) fcc ( 92 = 0), 
(l/>/2)(|Ql) + |10)) a5 ®|T+i) lia 
®(1/V^)(|01) + |10)) 6c (92 = 1). (11) 

Then he measures qubits 1,2 in the Bell basis { 1 0) 12 , 
|T) 12 , (1/V2)(|00) - jll)) 12 , (1/V2)(|01) - |10)) 12 }. He 
can gain one of two kinds of measurement outcomes 1 0) 12 
and 1 1)12, which denote bit and bit 1 respectively. The 
bit sent by Alice and that received by Bob are same when 
Alice and Bob share the carriers (l/\/2)(|00) + |11))& C , 
but inverse when they share (l/v / 2)(|01) + |10))f, c . 

After Bob has intercepted bit 0, he records dim = 0, 
and then records e 2m = 0,-0 = or e 2m = l,tp = 1 
randomly, but after Bob has intercepted bit 1, he records 
d>2m — 1) and then records e 2m = 0, ip = 1 or e 2m = 



1, ip = randomly. The message of bit d 2m is split into 
bit and bit ip. By the operation of resending bit, 
Bob sends bit ip to Charlie with the help of the carriers 
(1/V2(|00) + |ll)) 6c or (1/V2)(|01) + |10)) 6c . 

1 From the above analysis, we can see that when Al- 
ice, Bob, and Charlie share the carriers of (l/\/2~)(|00) + 
\ ll ))ab® (VV2)(|00) + |ll)) 6c , Alice's bit q 2m and Bob's 
bit d2m are identical, and Bob's bit ip and Charlie's bit 
are also identical. The sum of Alice's bit 92m, Bob's bit 
e2m and Charlie's bit is zero modulo 2, which makes Bob 
avoid detection. 

From the above analysis, we can also see that when Al- 
ice, Bob, and Charlie share the carriers of (l/v / 2)(|01) + 
l 10 )U® (VV2)(|01) + |10))be, Alice's bit q 2m and Bob's 
bit d2m are inverse, and Bob's bit ip and Charlie's bit 
are also inverse. Two inverse operations make the sum 
of Alice's bit 92m, Bob's bit e 2m and Charlie's bit be zero 
modulo 2, which makes Bob avoid detection. 

It seems that the above cheat result cannot work en- 
tirely because there are still two possibilities of Bob's 
eavesdropping bit string {d m , 1 < m < n}. However, 
according to the BK protocol in Ref. 1], the three le- 
gal parties have to compare a subsequence of the data 
bits publicly to detect eavesdropping. Bob announces the 
subsequence of the bit string {e m , 1 < m < n} publicly. 
Alice's bits or Charlie's bits will be leaked to Bob. More 
specifically, as long as any even numbered data bit except 
the second bit is announced, Bob can determine which 
kind of the two possible carriers was used and whether or 
not to flip the bits d 2m {^ < 2m < n). If the public bits 
include the second bit, only the second bit leads to error 
with probability 1/2, which can be hidden in quantum 
noise. Otherwise, in term of the kind of the carriers, Bob 
can know the bit 92 precisely. By this means Bob can 
obtain all the secret bits except for the little-probability 
event that all the compared bits are odd numbered plus 

2 numbered. 

In conclusion, we have presented a cheat strategy that 
allows Bob to gain all the secret bits before sharing, while 
introducing one data bit error at most in the whole com- 
munication, which makes the cheater avoid the detection 
by the communication parities. Consequently this proto- 
col cannot resist this type of attack. 
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